tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls

   1 ---
   2 # Copyright (C) The Arvados Authors. All rights reserved.
   3 #
   4 # SPDX-License-Identifier: AGPL-3.0
   5
   6 {%- import_yaml "ssl_key_encrypted.sls" as ssl_key_encrypted_pillar %}
   7 {%- set balanced_controller = ("__ENABLE_BALANCER__"|to_bool) %}
   8 {%- set server_name = grains['fqdn'] if balanced_controller else "__DOMAIN__" %}
   9
  10 ### NGINX
  11 nginx:
  12   ### SERVER
  13   server:
  14     config:
  15       ### STREAMS
  16       http:
  17         'geo $external_client':
  18           default: 1
  19           '127.0.0.0/8': 0
  20           '__CLUSTER_INT_CIDR__': 0
  21         upstream controller_upstream:
  22           - server: 'localhost:8003  fail_timeout=10s'
  23
  24   ### SITES
  25   servers:
  26     managed:
  27       ### DEFAULT
  28       arvados_controller_default.conf:
  29         enabled: true
  30         overwrite: true
  31         config:
  32           - server:
  33             - server_name: {{ server_name }}
  34             - listen:
  35               - 80 default
  36             - location /.well-known:
  37               - root: /var/www
  38             {%- if balanced_controller %}
  39             - index: index.html index.htm
  40             - location /:
  41               - proxy_pass: 'http://controller_upstream'
  42               - proxy_read_timeout: 300
  43               - proxy_connect_timeout: 90
  44               - proxy_redirect: 'off'
  45               - proxy_max_temp_file_size: 0
  46               - proxy_request_buffering: 'off'
  47               - proxy_buffering: 'off'
  48               - proxy_http_version: '1.1'
  49             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
  50             - error_log: /var/log/nginx/{{ server_name }}.error.log
  51             - client_max_body_size: 128m
  52             {%- else %}
  53             - location /:
  54               - return: '301 https://$host$request_uri'
  55             {%- endif %}
  56
  57       {%- if not balanced_controller %}
  58       arvados_controller_ssl.conf:
  59         enabled: true
  60         overwrite: true
  61         requires:
  62           __CERT_REQUIRES__
  63         config:
  64           - server:
  65             - server_name: {{ server_name }}
  66             - listen:
  67               - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
  68             - index: index.html index.htm
  69             - location /:
  70               - proxy_pass: 'http://controller_upstream'
  71               - proxy_read_timeout: 300
  72               - proxy_connect_timeout: 90
  73               - proxy_redirect: 'off'
  74               - proxy_set_header: X-Forwarded-Proto https
  75               - proxy_set_header: 'Host $http_host'
  76               - proxy_set_header: 'X-Real-IP $remote_addr'
  77               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
  78               - proxy_set_header: 'X-External-Client $external_client'
  79               - proxy_set_header: 'Upgrade $http_upgrade'
  80               - proxy_set_header: 'Connection "upgrade"'
  81               - proxy_max_temp_file_size: 0
  82               - proxy_request_buffering: 'off'
  83               - proxy_buffering: 'off'
  84               - proxy_http_version: '1.1'
  85             - include: snippets/ssl_hardening_default.conf
  86             - ssl_certificate: __CERT_PEM__
  87             - ssl_certificate_key: __CERT_KEY__
  88             {%- if ssl_key_encrypted_pillar.ssl_key_encrypted.enabled %}
  89             - ssl_password_file: {{ '/run/arvados/' | path_join(ssl_key_encrypted_pillar.ssl_key_encrypted.privkey_password_filename) }}
  90             {%- endif %}
  91             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
  92             - error_log: /var/log/nginx/{{ server_name }}.error.log
  93             - client_max_body_size: 128m
  94       {%- endif %}